TSS9221W ECSA Shortage due to Excessive Logging - Events may be lost

Document ID : KB000021589
Last Modified Date : 14/02/2018
Show Technical Document Details

Symptoms:

Excessive logging over an extended period of time can cause ECSA exhaustion.

If an ECSA Short-On-Storage condition is realized, we will issue the following message once every 30 seconds as long as the SOS condition exists.

TSS9221W ECSA Shortage due to Excessive Logging - Events may be lost

Resolution:

When the ECSA exhaustion has been alleviated, CA Top Secret will resume normal log processing.
The ESCA is filling up because records are not being written as fast as they are being audited.
Once the auditing slows down and the records that are being held in ESCA get written to the Audit file, then the ESCA should go back to normal.

Most likely the ESCA shortage is caused by the Audit attribute on active acids or ACTION(AUDIT) on facility permits.

To identify acids with the Audit attribute:

   TSS WHOHAS AUDIT  

To find all permits with ACTION(AUDIT) and ACTION(AUDIT) on any Facility permits (TSS ADD(acid) FAC(fac),

you will need to run TSSCFILE during off peak hours with the following input:

   TSS LIST(ACIDS) DATA(BASIC,XAUTH)  

Permits with ACTION(AUDIT) will have a record id of 2016 and in columns 49 through 56 it will say AUDIT.

If for some reason you do not find any auditing taking place, or if you reduce the amount of auditing and ECSA does not resume to normal, then an issue needs to be opened with Top Secret Support and an SVC dump will be needed, F TSS,SVCDUMP.